Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 03:40

General

  • Target

    c20a928da031aba8f6b10f7cd62f86eb3f70e479cb37223dc8108eb5a24d7e56.dll

  • Size

    120KB

  • MD5

    1c9200bd3df601e374f8b51e2210155a

  • SHA1

    274996d657d66f4920827c7afb30e19217176303

  • SHA256

    c20a928da031aba8f6b10f7cd62f86eb3f70e479cb37223dc8108eb5a24d7e56

  • SHA512

    a74b54ed04d0981fe014af46de6fe9f24520fc54077a618fd6d1e638b7ee418e92c938c662d538ebc95d4b86baee97ff16f9d999ce1d9d6933213338bba1ce50

  • SSDEEP

    3072:Ctni6LzJJ/mxAoY5k1pMfDTdZqQVkZU5/E:CRTt2AoYi1pQ5ZqQ

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 26 IoCs
  • UPX dump on OEP (original entry point) 30 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1248
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1316
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1372
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\c20a928da031aba8f6b10f7cd62f86eb3f70e479cb37223dc8108eb5a24d7e56.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1768
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\c20a928da031aba8f6b10f7cd62f86eb3f70e479cb37223dc8108eb5a24d7e56.dll,#1
              3⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2280
              • C:\Users\Admin\AppData\Local\Temp\f767a9c.exe
                C:\Users\Admin\AppData\Local\Temp\f767a9c.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2556
              • C:\Users\Admin\AppData\Local\Temp\f767cfd.exe
                C:\Users\Admin\AppData\Local\Temp\f767cfd.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • System policy modification
                PID:2836
              • C:\Users\Admin\AppData\Local\Temp\f769147.exe
                C:\Users\Admin\AppData\Local\Temp\f769147.exe
                4⤵
                • Executes dropped EXE
                PID:2104
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1960

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            95a8a09f5d449b2ece5003059d54fb1e

            SHA1

            eee2418e156094c6201941231c69f2847bc46605

            SHA256

            1ba9f606ffc3808de3ca16037914f849934bd070d0486577081f122ac0fd85d3

            SHA512

            5d7ad77aa0b622ff940258939a312ed4427311849a3ed0e40a1fdbe47a6e5496d943a7d8d45114fb5297728ad96381f22966340553e02df3030309e0099177da

          • \Users\Admin\AppData\Local\Temp\f767a9c.exe

            Filesize

            97KB

            MD5

            91b209ae3f0359ed8c212721fe1eeab6

            SHA1

            3484d9ba2b828db836ddb16050a9d8f3da2f16d1

            SHA256

            8143d8a2c9eaa4ff0a087063c870299d5a80e3a3c205946bec9fcf3f20c1b2d6

            SHA512

            761b801ee9c6ae489e0106bb1489f119613fedfae6093ef7ed61cf0126fbb29903cd79a06b64bebec029c574ba08df9eeeaf4373446f88e97d7fafac51cfce30

          • memory/1248-20-0x0000000000310000-0x0000000000312000-memory.dmp

            Filesize

            8KB

          • memory/2104-101-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/2104-76-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2104-99-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/2104-173-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2104-98-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2280-27-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/2280-26-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2280-48-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2280-55-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2280-54-0x0000000000290000-0x00000000002A2000-memory.dmp

            Filesize

            72KB

          • memory/2280-3-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2280-10-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2280-72-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2280-38-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/2280-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2556-19-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-81-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-18-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-37-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-36-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-49-0x00000000005C0000-0x00000000005C2000-memory.dmp

            Filesize

            8KB

          • memory/2556-17-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-59-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-60-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-61-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-62-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-63-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-14-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-39-0x0000000001960000-0x0000000001961000-memory.dmp

            Filesize

            4KB

          • memory/2556-77-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-78-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-80-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-35-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-83-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-15-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-16-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-13-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-56-0x00000000005C0000-0x00000000005C2000-memory.dmp

            Filesize

            8KB

          • memory/2556-143-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-142-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2556-102-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-103-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2556-106-0x00000000006D0000-0x000000000178A000-memory.dmp

            Filesize

            16.7MB

          • memory/2836-91-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/2836-93-0x0000000000270000-0x0000000000272000-memory.dmp

            Filesize

            8KB

          • memory/2836-58-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2836-162-0x0000000000910000-0x00000000019CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2836-169-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2836-168-0x0000000000910000-0x00000000019CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2836-100-0x0000000000270000-0x0000000000272000-memory.dmp

            Filesize

            8KB